A key added by one account made that provider's whole catalogue look available to every other account, so Auto could pick a model nobody else could pay for and the turn died. No key was ever read, decrypted or sent by anyone but its owner — what escaped was the fact that it existed. Availability is now scoped to whoever is asking, and suspending a key in the admin screen really takes it out of service.